Remove staff member required decorator

[ViolanteCodes]

Removes staff member required decorator to allow view reuse while adding regression tests to make sure future changes don't result in accidental access to gated views

[Copilot]

Pull request overview

Removes @staff_member_required from form builder view functions to make them reusable outside the admin registration, and adds regression tests to ensure the admin-mounted endpoints remain staff-gated via admin_site.admin_view.

Changes:

• Dropped @staff_member_required from all form builder views in form_builder_views.py.
• Added “requires staff” regression tests for multiple form builder/admin endpoints.
• Documented the change in CHANGELOG.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
tests/test_builders.py	Adds regression tests asserting non-staff users are blocked from admin-mounted form builder endpoints.
django_forms_workflows/form_builder_views.py	Removes @staff_member_required decorators from form builder endpoints, relying on URL-layer gating.
CHANGELOG.md	Notes removal of @staff_member_required and the rationale (admin routes already wrapped in admin_view).

Suppressed comments (1)

django_forms_workflows/form_builder_views.py:36

• Removing @staff_member_required from these views makes them rely entirely on the URL registration for access control. That’s true for the admin URLs (they’re wrapped via self.admin_site.admin_view(...) in django_forms_workflows/admin.py:get_urls()), but django_forms_workflows/form_builder_urls.py currently maps these views directly (e.g. path("new/", form_builder_views.form_builder_view, ...)) without admin_view/staff gating. Including that URLConf as documented would expose builder and write endpoints to non-staff/anonymous users.

@require_GET
def form_builder_templates(request):
    """
    API endpoint to list available form templates.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.